Secure, reproducible builds for NPM

RFC: https://github.com/npm/rfcs/pull/16/files?short_path=5c765e6

Summarized algorithm: https://cdn-images-1.medium.com/max/800/1*1b7KHDG2St5D-6jepf...

Good luck with the PR. After recent events, it's good to see ideas like this make it back upstream for serious discussion.